This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

www-search.net is taking over, need help

8 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

This thread's last reply is from March 12, 2014, 3:45 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Cypher Admin/Teacher
March 11, 2014, 6:06 PM UTC
"Sellon05" wrote:Everything seems to be running smoothly now, no sign of Tuvaro at all!

Excellent :thumbup: but i need you to run one more scan for me.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • First please Disable any Antivirus you have active, as shown in This topic.
  • Note: Don't forget to re-enable it after the scan.
  • Next hold down Control then click on the following link to open a new window to ESET online scannner
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • When prompted allow the Add-On/Active X to install.
  • Click on Run ESET Online Scanner, then elect the option YES, I accept the Terms of Use, then click Start.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on Start.
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on Finish.
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
Sellon05
March 11, 2014, 9:52 PM UTC
ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ed36f42150880248b877862951a8bdd0
# engine=17403
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-03-11 09:50:18
# local_time=2014-03-11 03:50:18 (-0700, Mountain Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 13650681 146118068 0 0
# scanned=129117
# found=5
# cleaned=0
# scan_time=3146
sh=04D02A27F924CCA6222B45027779462538070735 ft=1 fh=6d4a723d85390481 vn="Win32/DownloadAdmin.G potentially unwanted application" ac=I fn="C:\Users\Sellon\Downloads\hexcolorfinder-setup.exe"
sh=0F33FFF12F6552F1790D3825DBB1B7A0D359EA56 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B potentially unwanted application" ac=I fn="C:\zoek_backup\[redacted]\extensionData\plugins\217_similar_products_m.js"
sh=1C4A6EF22D66B4B3AC5CFD6620EFC10D8145A209 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B potentially unwanted application" ac=I fn="C:\zoek_backup\[redacted]\extensionData\plugins\242_price_gong_m.js"
sh=DC790DFB6D4E0C15D927A3B20EFC147F44D4F5E7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B potentially unwanted application" ac=I fn="C:\zoek_backup\[redacted]\extensionData\plugins\91_monetizationLoader.js.js"
sh=82375A6153BE4F1F134E2E0A6077B67597E7F382 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B potentially unwanted application" ac=I fn="C:\zoek_backup\[redacted]\extensionData\plugins\93_superfish_no_coupons_m.js"
Cypher Admin/Teacher
March 12, 2014, 9:39 AM UTC
Hi Sellon05,
Can you give me another update on how your computer is running, still no sign of Tuvaro ?
Sellon05
March 12, 2014, 3:33 PM UTC
Yes, so far so good. No problems.
Cypher Admin/Teacher
March 12, 2014, 3:37 PM UTC
Hi Sellon05,
Yes, so far so good. No problems.

In that case you're good to go :)

Time for some housekeeping

Please download delfix and save it to your desktop.
  • Right-click on delfix.exe and select " Run as administrator " to run it.
  • Check the following boxes then click on Run.

    • Remove disinfection tools
  • All tools we used to clean your computer should be gone now.


You can now delete any tools/logs we used if they remain on your Desktop.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.


I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!
Sellon05
March 12, 2014, 3:41 PM UTC
Great, I really appreciate it. Thanks so much!
Cypher Admin/Teacher
March 12, 2014, 3:45 PM UTC
"Sellon05" wrote:Great, I really appreciate it. Thanks so much!

You're more than welcome, glad we could help :)
As you have no questions i will close this topic, good luck and stay safe.

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.